Was ist enthalten

Eine SKILL.md (die Anleitung) + eine Startvorlage. Eine Vorschau:

PHP2Shell Vulnerability Check

The facts this skill runs on (verified 2026-10-21)

• PHP2Shell = CVE-2026-109618 + CVE-2026-109619, both CVSS v4.0 9.2, unauthenticated remote code execution in the PHP interpreter itself. The malicious request is processed before any application code runs — logins and app-level auth do not block it, and even a one-line test page exposes the flaw.
• Fixed upstream releases (21 Oct 2026): PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Anything older on those branches is vulnerable.
• PHP 8.1 and older (back to 5.x): affected and end-of-life. PHP provides only minimal source backports for 7.4/8.0/8.1 that you must compile yourself, and there is no official binary patch; the fix is moving to a fixed, supported release. (Some Linux distros backport — step 4 handles that.)
• Only patching fixes it. The circulating tip to set session.upload_progress.enabled=0 blocks the attack path most abused in the wild (per Hadrian/Upwind) but is NOT a complete fix — Datadog's reproduction showed other paths remain; only the PHP update fully fixes these flaws. WAF rules are a stopgap, not a fix.
• WordPress/CMS updates do not update PHP. The PHP version is set by the server/hosting plan.
• Japan's prime minister and several national cybersecurity agencies advised on 2026-10-21: patch immediately, or temporarily take the site offline until you can.
• Sources: php.net security release; Datadog Security Labs, "PHP2Shell — detection, analysis, and remediation"; Ubuntu php2shell advisory; Tenable FAQ.

When to use

• You own or operate any website and heard about the PHP vulnerabilities in the news — you want a straight answer: *am I exposed?*
• You run WordPress, Drupal, Joomla, Magento, or anything PHP-based and don't know which PHP version the server uses.
• Your host sent a vague "we are aware" email and you want to verify the fix yourself.
• You patched (or your host says they patched) and want independent confirmation.

Safety rules (non-negotiable)

• Only check sites the user owns or is explicitly authorized to test. If ownership/authorization is unclear, stop and ask.
• Read-only checks only. Headers, public pages, version comparison. Never send an exploit request or attack payload to any server — the verdict comes from fingerprinting, never from exploitation.
• Never report "safe" from absence of evidence. A hidden version means "unconfirmed", and the report must say so.

Workflow

1. Scope and permission (input: user's site list → output: confirmed check list)
   Confirm each site is the user's to test. Note for each: where it is hosted (shared host, VPS, Docker, managed WordPress) and whether the user has server/shell access — this decides which steps can run.
2. Remote fingerprint (input: site URL → output: version evidence or "hidden")
   Method A — the free online checker (same logic as this skill, hosted): GET https://aiservicesmarket.lol/api/php2shell-check?url= returns a JSON verdict with its evidence.
   Method B — independent raw check (do at least one raw check yourself; don't just relay Method A):

• curl -sI https://site.example | grep -iE 'x-powered-by|^server:|set-cookie' — look for PHP/x.y.z in X-Powered-By or the Server header, and PHPSESSID cookies (PHP present, version unknown).
• Fetch the homepage and look for CMS markers (wp-content → WordPress, etc.): a PHP-based CMS with no version still means PHP is in play.
  Record exactly which signal produced the version — the report cites it.

1. Exposed phpinfo probe (input: site origin → output: exact version and/or an exposure finding)
   curl -s https://site.example/phpinfo.php and /info.php. If a phpinfo page answers, extract the version from its header ("PHP Version x.y.z"). The exposure itself is a critical finding regardless of version: phpinfo prints the full server configuration to the public. Tell the user to remove or protect it today, and record it in the report.
2. Verdict against the fixed table (input: version + suffix → output: one of five verdicts)

• Version ≥ fixed release for its branch (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12) → Patched.
• Version below the fixed release, clean upstream string → Vulnerable.
• Version is 8.1 or older → Vulnerable + end-of-life (no official binary patch exists; remediation is an upgrade — unless step 4a clears it).
• 4a. Distro backport check. If the version string carries a package suffix (-1ubuntu…, -deb…, +deb…), the distro may have backported the fix into an old-looking number. Compare the *full package version* against the distro's fixed packages (examples from Ubuntu's advisory: Ubuntu 24.04 php8.3 fixed in 8.3.6-0ubuntu0.24.04.13; Ubuntu 22.04 php8.1 fixed in 8.1.2-1ubuntu2.28). Get the package version from the server (dpkg -l | grep php, rpm -q php) or the host. New enough → Patched (distro backport); older or unprovable → treat as Vulnerable and say why.
• No version found but PHP signals present → Unconfirmed — version hidden. Never soften this into "probably fine".

1. Resolve the hidden-version case (input: hosting setup → output: the version, from the server side)

• Shell access: php -v (and for FPM: the version the web server actually runs — check the pool/FPM binary too, CLI and FPM versions can differ).
• Hosting panel: most panels (cPanel → MultiPHP Manager, Plesk → PHP Settings) show and select the version per site.
• No access: send the host this exact message — *"Which PHP version does my site [domain] run, and is it at or past the fixed PHP2Shell releases (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12)? If not, when will you apply the update? Please confirm in writing."* Then run step 4 on their answer.

1. Remediation walkthrough (input: verdict + hosting setup → output: patched server or a deliberate temporary-offline decision)

• Fixed-branch update paths: distro packages (apt update && apt upgrade php*, then restart PHP-FPM/Apache), hosting panel PHP-version selector (pick a *fixed* release, not just a newer branch), Docker (bump the image tag to a fixed release and redeploy), source builds (rebuild with the fixed tarball).
• EOL branch: schedule the move to 8.2+ fixed; check the site's CMS/plugin compatibility first, but do not let "later" win — if the move can't happen now, use the stopgap below.
• Stopgap if patching will take time: temporarily take the site offline or restrict access (the explicit advice of Japan's PM and national agencies on disclosure day), and/or put a WAF/CDN rule set in front — labelled clearly as a stopgap, never as the fix.
• Remove the exposed phpinfo page found in step 3.

1. Verify the fix (input: patched server → output: confirmed version, two ways)
   Re-run step 2's fingerprint and confirm on the server (php -v / panel). Both must show a fixed version. Then look for signs of earlier exploitation (per Datadog's hunting notes): unusually large form submissions in access logs, memory-exhaustion errors during request initialization, and unexpected shell processes spawned by PHP workers. Any hit → tell the user this is now an incident-response matter, not a patching matter.
2. Write the owner report (input: all findings → output: the one-page report in template.md)
   One page per site: verdict in the first line, evidence, the fix applied (or the decision taken), verification result, and the date. Plain language — the reader is a site owner, not a security engineer.

Vorschau der Startvorlage

PHP2Shell Owner Report

One page per site. Fill every field — "unknown" is an answer, a blank is not.

Site

• Website:
• Hosting / server:
• Checked on (date, time, timezone):
• Checked by:

Verdict (tick one)

• [ ] Patched — running a fixed PHP release
• [ ] Patched via distro backport — old-looking version, fixed package (evidence below)
• [ ] Vulnerable — below the fixed release for its branch
• [ ] Vulnerable + end-of-life — PHP 8.1 or older; no official binary patch for this branch (PHP source backports exist for 7.4/8.0/8.1; distro backports may apply)
• [ ] Unconfirmed — site runs PHP but hides its version; server-side check still needed

Das Skill-Paket selbst (SKILL.md + Vorlage) ist auf Englisch verfasst.

Das komplette Skill-Paket kaufen — $4.99 Pro — alle 511 Skills